Find Out All The Autostart Programs And Processes Using Autoruns

Sometime back I wrote about Msconfig method to decrease the PC boot up time. Though MSConfig find most of the startup programs but some programs keep themselves hidden (such as toolbars) so that MSconfig fails to catch them. These programs leads to increase boot time and slow down of PC. They also eat system resources and reduces CPU speed.

There is a tool called Autoruns that finds all the startup programs as well as processes and display it in a nice tabbed window. It shows you the list of programs that are configured to run during system bootup. It also displays the entries in the order Windows processes them.

You can configure Autoruns to show other locations, including Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more. It shows you the currently configured auto-start applications along with the full list of Registry.


You can either disable or delete the entry for the program or process you don’t want to activate while bootup. To disable an entry, simple uncheck the box next to the process name.

There are several tabs given on the program window. Each tab has separate function. Let’s have a look on them:

  • Explorer: It displays Explorer shell extensions, browser helper objects, explorer toolbars, active setup executions, and shell execute hooks.
  • Logon: The program scans the standard autostart locations such as the Startup folder for the current user and all users, the Run Registry keys, and standard application launch locations and display the result in this entry.
  • Internet Explorer: This entry shows Browser Helper Objects (BHO’s), Internet Explorer toolbars and extensions.
  • Services: Switch to this tab to see all the Windows services which are configured to start automatically with the system bootup.
  • Drivers: It displays all kernel-mode drivers registered on the system except those that are disabled.
  • Scheduled Tasks: Task scheduler tasks configured to start at boot or logon.
  • AppInit DLLs This has Autoruns shows DLLs registered as application initialization DLLs.
  • Boot Execute Native images (as opposed to Windows images) that run early during the boot process.
  • Image Hijacks Image file execution options and command prompt autostarts.
  • Known DLLs This reports the location of DLLs that Windows loads into applications that reference them.
  • Winlogon Notifications Shows DLLs that register for Winlogon notification of logon events.
  • Winsock Providers: Shows registered Winsock protocols, including Winsock service providers. Malware often installs itself as a Winsock service provider because there are few tools that can remove them. Autoruns can uninstall them, but cannot disable them.
  • LSA Providers Shows registers Local Security Authority (LSA) authentication, notification and security packages.
  • Printe Monitor Drivers Displays DLLs that load into the print spooling service. Malware has used this support to autostart itself.
  • Sidebar Displays Windows Vista/ Windows 7 sidebar gadgets.

This tool comes in a zip format. You can extract it to USB drive and directly open it from there (portable application). This program is available for Windows XP, Vista and Windows 7 users. Command line version of Autorun is also available which is known as Autorunsc.

Download Autorun and  Autorunsc.

Leave a Reply

Your email address will not be published. Required fields are marked *